CVE-2026-88177: CWE-125: Out-of-bounds Read in Microsoft Windows 10 Version 1607

This vulnerability (CVE-2026-88177) is an out-of-bounds read flaw in the Windows Desktop Window Manager (DWM) Core Library. It permits an authorized local attacker to perform a privilege escalation on affected Windows 10 versions. The flaw impacts multiple Windows 10 builds starting from 10.0.14393.0 up to but excluding various patch levels (e.g., <10.0.14393.9612, <10.0.17763.9376, etc.). The CVSS 3.1 vector indicates low attack complexity, requires local privileges, no user interaction, and results in high confidentiality, integrity, and availability impacts. Microsoft has issued official patches to remediate this vulnerability.

Successful exploitation allows an authorized local attacker to elevate privileges, potentially gaining higher system rights. This can lead to full system compromise, including unauthorized access to sensitive data and disruption of system operations. The vulnerability affects confidentiality, integrity, and availability with high severity.

Microsoft has released official security updates that address this vulnerability. Users and administrators should apply the relevant patches for their Windows 10 versions as listed in the affected versions to remediate the issue. No additional mitigation actions are indicated by the vendor advisory.